DoT (DNS over TLS)

DoT (DNS over TLS) is a protocol that encrypts DNS queries and responses inside a secure TLS connection. Traditional DNS sends data in plain text, so any intermediary — an internet provider, a Wi-Fi administrator or an attacker — can see which domains you visit and even alter the answers. DoT solves this by wrapping all DNS traffic in an encrypted channel on the dedicated port 853.

How DoT works

When a device is configured with a DoT-capable resolver, it opens a TLS connection to it, just as a browser does with an HTTPS website. The server presents a certificate that the client verifies, and every query and response then travels through the encrypted tunnel. Because DoT uses a separate port 853, this traffic is easy to identify on the network, letting administrators deliberately manage or block it. That is the main contrast with DoH, which hides DNS inside ordinary HTTPS traffic on port 443. To reduce connection overhead, DoT usually keeps a TLS session open and sends many queries over it, rather than opening a fresh tunnel for each one.

Practical applications

DoT protects user privacy on public networks, hinders man-in-the-middle attacks, and stops providers from profiling users by the domains they visit. It is supported by Android (as the Private DNS mode), major public resolvers and common server software such as stubby and unbound. Enterprises often prefer DoT precisely because of its recognisable port — IT teams can monitor and filter queries in line with security policy while still being sure the query contents are encrypted. Server-side deployment requires a valid TLS certificate, exactly as an HTTPS website does. Keep in mind that encrypting the transport does not guarantee the authenticity of the answers; that is the job of DNSSEC, which verifies the cryptographic signatures of records and pairs well with DoT to deliver both confidentiality and integrity for DNS data.